CVE-2021-21357 — Improper Input Validation in Typo3

CWE-20 — Improper Input ValidationCWE-22 — Path TraversalCWE-434 — Unrestricted File Upload4 documents4 sources
Severity
8.3HIGHNVD
EPSS
1.1%
top 21.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Typo3Typo3 CMSTypo3 Cms-core+2 more
Timeline
PublishedMar 23

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:HExploitability: 2.8 | Impact: 5.5

Affected Packages5 packages

▶Packagisttypo3/cms-form8.0.0 — 8.7.40+3
▶Packagisttypo3/cms10.0.0 — 10.4.14+2
▶NVDtypo3/typo38.0.0 — 8.7.40+3
▶Packagisttypo3/cms-core10.0.0 — 10.4.14+2
▶CVEListV5typo3/typo3.cms4 versions+3

🔴Vulnerability Details

3
CVEList
Broken Access Control in Form Framework↗2021-03-23
▶
OSV
Broken Access Control in Form Framework↗2021-03-23
▶
GHSA
Broken Access Control in Form Framework↗2021-03-23
▶
CVE-2021-21357 — Improper Input Validation in Typo3 | cvebase